1

I've been a bit lost. I have the following situation:

Flash Player file is on https://sub.example.com/player.swf

crossdomain.xml is on https://sub2.example.com/crossdomain.xml

Streaming is done using Wowza.

The crossdomain.xml right now is everything but tight:

<cross-domain-policy>
  <allow-access-from domain="*" secure="false"/>
  <site-control permitted-cross-domain-policies="all"/>
</cross-domain-policy>

I've tried to figure this out myself and have read the following posts about this:

Still my question remains and is: How should the crossdomain.xml look like in this case to protect properly and why? There are no reasons other players should access the stream besides player.swf on the different subdomain.

1

A properly locked down policy would look like this in your situation:

<cross-domain-policy>
  <allow-access-from domain="sub.example.com" secure="true"/>
  <site-control permitted-cross-domain-policies="all"/>
</cross-domain-policy>

Allowing * wildcard for all domains means that user sessions on sub2.example.com could be compromised by a malicious Flash app on another domain that the users visits.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.